CCI-000125

The organization provides a rationale for why the list of auditable events is deemed to be adequate to support after-the-fact investigations of security incidents.

Implementation Guidance

The organization being inspected/assessed documents in the audit and accountability policy the list of auditable system events, the organization provides clearly stated rationale for the selection of each system event. The rationale will support any after-action investigations of security event.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit and accountability policy and procedures to ensure the organization being inspected/assess has defined the auditable system events, rationale for the selection, and that the organization has defined how the auditable events will support after-action investigations of security events.

Compelling Evidence

1.) Signed and dated audit and accountability policy 2.) Sample of after-action investigations of security event

The controls below (if any) were marked by NIST as being related to CCI-000125.